Privacy Policy
Effective date: 14 October 2026
This policy explains what data LOOM Weather ("LOOM") collects, why, who processes it, how long we keep it, and your rights.
1. Who runs LOOM
LOOM is run by Riccardo Pittiglio, trading as LOOM Weather, Strassergasse 8-12/4/10, 1190 Wien, Austria, as an individual. He decides how your data is used (the "controller"). Contact for anything about your data: support@loomweather.com.
2. What we collect
- Account. A random account id. If you sign in with Apple, Google or email: your email address, and the name you share. Google sign-in also gives us the link to your Google profile photo; we store it with your sign-in record and do not show it in LOOM. Your own profile photo is one you choose to add.
- Your closet. Photos of your clothes, the cut-out and display copies we make of them, and what we read from them (type, colour, material, fit).
- Your selfie and Avatar. If you create an Avatar: the selfie you upload and the Avatar made from it. They are used only to make your Avatar and your try-ons. We delete the selfie as soon as you choose your Avatar. We delete them when you delete them or your account, and automatically after 12 months without using your Avatar.
- Try-on pictures. The pictures made when you try on outfits, and the ones you keep.
- Stylist chats. Your messages to the stylist, photos you send it, and its answers.
- Outfits and wear history. Outfits you plan, wear or save, and the weather and city they were for.
- Location. The city you choose, or your phone's location if you allow it, to get your weather. Before we ask weather services, we round it to about 1 km. The cities you save are kept with their map position until you remove them.
- Purchases. Your subscription and try-on credits: what you bought, when, and how many credits you used.
- Notifications. Your device's notification token, if you allow notifications.
- Usage and errors. When you open LOOM (with the app version and your time zone) and which features you use, linked to your account; and crash and error reports and how quickly the app responds, with your phone's model and iOS version, sent without your name or contact details. You can turn both off in Profile (Share Usage and Crash Reports).
- Your age range. Whether your phone says you are an adult, a teen or a child (Apple's age range, or the year of birth you enter), so LOOM offers only what suits your age. We keep the range, never your date of birth.
- Searches. The cities you look up and the places you ask the stylist about, to find their weather and their dress code. A search is not kept with your account.
- Device and app details. Identifiers that LOOM and our purchase service (RevenueCat) set on your phone, so your purchases and our error reports work. They are never used for ads.
- Your IP address. Every internet service sees it when the app connects. We use only the country it points to, to know which country's rules apply where you are. Our hosting provider keeps it in its logs for 7 days.
- Problem reports. If you use Report a Problem, we get the words you type, the app version, the last error the app hit, and your account id. Before anything is sent, we remove emails, phone numbers, links, map positions and codes, and we keep at most 2,000 characters. For people in the UK under 18 we do not attach the account id, and nothing is sent when Share Usage and Crash Reports is off. If you write to support@loomweather.com, we get your email address and what you write.
- Your choices (sections 8 and 9: help improve LOOM's AI, product emails, share anonymous trends with brands), and when you changed them.
3. Why we use it, and on what legal basis
- To run LOOM for you (Art. 6(1)(b) GDPR, our contract with you): your account, closet, outfits, wear history, location, chats, purchases and notifications. This includes styling you and learning your taste, which is part of the service. You can turn AI styling off in Profile; in Canada, and for people under 18 in the United Kingdom, it stays off until you say yes.
- Your selfie, Avatar and try-ons of your Avatar (Art. 6(1)(a) and Art. 9(2)(a) GDPR, your explicit consent).
- To improve LOOM and fix problems (Art. 6(1)(f) GDPR, our legitimate interest in a working, safe app): usage data and error reports. They are linked to your account ID (never your name or email), never used for ads or tracking, and you can turn them off in Profile with Share Usage and Crash Reports.
- To improve LOOM's AI, to send product emails and to share anonymous trends with brands (Art. 6(1)(a) GDPR, your consent): only if you say yes (sections 8 and 9).
- To meet legal duties (Art. 6(1)(c) GDPR): for example keeping a record that an account was deleted.
- To tell Apple how a purchase was used when you ask Apple for a refund (Art. 6(1)(b) and (f) GDPR).
4. Where your pictures are kept
Your pictures are stored on Cloudflare R2: the clothes you add and the copies we make of them, your selfie and Avatar, try-on pictures, photos you send the stylist, and your profile photo. Each picture has its own long, random web address that cannot be guessed or listed. Cloudinary holds a few older pictures from before we moved to Cloudflare (garment originals, worn-outfit and try-on pictures and chat thumbnails, about 60 today), and a copy of a new picture only if Cloudflare fails at the moment it is saved. When you delete your account, we delete your pictures from both. Pictures made by FASHN or fal.ai may also stay for a short time on their own servers, which we cannot delete; they expire by themselves.
5. Services that process your data
| Service | What it does for LOOM | What it receives | Where | Safeguard for a transfer outside the EU |
|---|---|---|---|---|
| Supabase | Database, sign-in, server code | Everything in section 2 | Database in the EU (Ireland); company in the US | Standard Contractual Clauses (in its data processing agreement) |
| Cloudflare | Stores and delivers pictures; hosts this website | Your pictures | Global | EU-US Data Privacy Framework; Standard Contractual Clauses as fallback |
| Cloudinary | Older pictures and emergency copies (section 4) | Those pictures | US | EU-US Data Privacy Framework |
| Anthropic (Claude) | Reads your clothes photos, reads photos you send the stylist, writes the stylist's answers | Clothes photos, chat messages and photos, your closet and weather | US (our contract is with Anthropic Ireland, Limited) | Standard Contractual Clauses |
| FASHN | Makes try-on pictures and your Avatar | Your selfie, Avatar and clothes pictures | UK (company in London). FASHN's own providers: Google Cloud (worldwide), fal (US, and where its model operators are), BytePlus (Singapore, Malaysia, Indonesia) and a database host (US) | UK adequacy decision; for FASHN's providers, FASHN's data processing agreement |
| fal.ai | Removes picture backgrounds, runs AI Cleanup, helps make your Avatar | Clothes pictures, selfie and Avatar pictures | US | Standard Contractual Clauses |
| OpenAI | The image model behind AI Cleanup (run through fal.ai; directly by OpenAI only as a backup) | The clothes photo being cleaned up | US | Through fal.ai (Standard Contractual Clauses); directly: OpenAI's data processing agreement |
| Apple | Weather and weather warnings (WeatherKit), city search and the kind of place you name to the stylist (Apple Maps), Sign in with Apple, notifications, purchases; and, when you ask Apple for a refund, how that purchase was used | Location rounded to about 1 km, city names, the names of places you ask the stylist about with a city-level area (about 10 km), your sign-in, your device token, purchase use | US | Apple's own data protection terms |
| Sign in with Google | Your Google sign-in | US | EU-US Data Privacy Framework or Standard Contractual Clauses (Google's controller terms) | |
| Open-Meteo | Air quality, pollen and sea levels on the Forecast screen | Location rounded to about 1 km | Switzerland | Adequacy decision (Switzerland) |
| RevenueCat | Handles your purchases and subscription | Your LOOM account id, your purchases, and an identifier for your device | US | Standard Contractual Clauses |
| Sentry | Crash and error reports, and the problem reports you send | Error details and your problem reports, without your name or contact details | EU (Germany); Sentry's company is in the US | EU-US Data Privacy Framework; Standard Contractual Clauses as fallback |
Weather warnings come from the official agency of each country (for example GeoSphere Austria), passed on by Apple.
6. How long we keep it
- Your selfie and Avatar: the selfie is deleted as soon as you choose your Avatar. Otherwise, until you delete them or your account, and automatically after 12 months without using your Avatar.
- Until you delete your account: your account, closet and its pictures, try-on pictures and kept looks, saved chats, outfits and wear history, purchases, notification token, and your data choices. Deleting your account deletes all of it, including your RevenueCat purchase record.
- Chats you do not save: deleted after 24 hours without activity.
- Usage records of the stylist: 180 days. Cost records: 13 months. Security log: 90 days. Emails you send to support: 3 years.
- Weather lookups: kept for minutes, by place only, never with your account.
- One record that an account was deleted, without any name or account id, kept as proof that we deleted it.
7. Sharing
We do not sell your personal data. We do not show ads. We do not use advertising trackers. We share data only with the services in section 5, to run LOOM, and as you choose in sections 8 and 9.
8. Your choice: Help improve LOOM's AI (off until you say yes)
If you say yes to Help Improve LOOM's AI, your clothes, your outfit choices and the photos of your clothes may be used to teach LOOM's own AI to suggest better outfits, by LOOM and by the services that work on LOOM's behalf (section 5). Never anyone else's models, and never your face or any photo of you (your selfie, your Avatar and try-on pictures). We ask only people who are 18 or older. It stays off until you say yes, you can change it at any time in Profile, and turning it off stops any future use. It is not active yet: we train no model today, and we will tell you before anything is first used.
9. Your choices: product emails, and sharing anonymous trends with brands (each off until you say yes)
Product emails (off until you say yes): if you tick "Email me styling tips and news from LOOM" when you sign in, or turn on Product Emails in Profile, we may email you styling tips and news about LOOM. Every email has an unsubscribe link, and you can turn them off in Profile at any time. We ask only people who are 18 or older, and we send none yet.
Share anonymous trends with brands (off until you say yes): if you say yes, LOOM may share anonymous, aggregated style trends with fashion brands, for example which kinds of garments, colours and outfits people wear in which weather, so they can make clothes for how people really dress. LOOM may be paid for these trends. They are always combined from many people and never include photos, your face, your name, your contact details, your exact location or anything else that identifies you. We ask only people who are 18 or older, and we ask at a different moment from Help Improve LOOM's AI. It stays off until you say yes, you can change it at any time in Profile, and turning it off stops any future sharing; trends already shared cannot be recalled. It is not active yet: we share nothing today (from your yes we start keeping the anonymous records the trends would be made from), and before anything is first shared we will tell you which kind of brands receive what. A yes given in an earlier version of LOOM is not used.
Our promise: we will never try to re-identify anyone from anonymous or aggregated data, and every recipient must promise the same in writing.
10. Your rights
You can: see the data we hold about you; correct it; delete it (Profile, Delete Account, or ask us); get a copy in a common format to take elsewhere (ask us); object to our use based on legitimate interest; withdraw any consent at any time (it does not affect what was done before); and complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at) or the authority where you live. Write to support@loomweather.com. We answer within one month.
If you live in Mexico, Colombia or Bermuda
Mexico. Your selfie and your Avatar are sensitive personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. We collect them only with your express consent, given on the Avatar consent screen, and you can withdraw it at any time. You can exercise your rights of access, rectification, cancellation and opposition (ARCO rights), or withdraw your consent, by writing to support@loomweather.com. The services named in section 5 receive the data outside Mexico only to provide LOOM to you. The supervisory authority is the Secretaría Anticorrupción y Buen Gobierno.
Colombia. Your selfie and your Avatar are sensitive (biometric) data under Law 1581 of 2012. You do not have to provide them, and the rest of LOOM works without them. We process them only with your prior, express authorisation, given on the Avatar consent screen; by giving it you also authorise sending them to the services named in section 5, outside Colombia. You can know, update, correct and delete your data, ask for proof of your authorisation and revoke it, by writing to support@loomweather.com. We answer questions within 10 business days and complaints within 15 business days. You can complain to the Superintendencia de Industria y Comercio (sic.gov.co).
Bermuda. Our privacy officer under the Personal Information Protection Act 2016 is Riccardo Pittiglio, who you can reach at support@loomweather.com.
If you live in Chile
From 1 December 2026, Law 21.719 protects your personal data in Chile. We treat your selfie and your Avatar as sensitive (biometric) personal data. You do not have to provide them, and the rest of LOOM works without them. We process them only with your express consent, given on the Avatar consent screen, and you can withdraw it at any time. They are used only to make your Avatar (a picture of you made from your selfie) and your try-ons. We delete the selfie as soon as you choose your Avatar, and the rest when you delete it or your account, and automatically after 12 months without using your Avatar. You can ask for access, rectification, deletion (supresión), objection, portability and blocking of your data, by writing to support@loomweather.com. We answer within 30 calendar days, which the law lets us extend once by up to 30 more days. The services named in section 5 receive the data outside Chile only to provide LOOM to you, under written contracts. If we refuse or do not answer, you can complain, within 30 working days, to the Agencia de Protección de Datos Personales, the Chilean data protection authority.
If you live in Japan
Our notice for people in Japan, in Japanese, is at loomweather.com/ja/privacy (個人情報の取扱いについて).
If you live in Switzerland
The Swiss Federal Act on Data Protection (FADP) also protects you. You have the same rights as everyone else (see above), and you can write to support@loomweather.com. Your selfie and Avatar are used only with your explicit consent, given on the Avatar consent screen. You can complain to the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).
Transfers from Switzerland. Some of the services in section 5 handle your data outside Switzerland. For each one, the country and the safeguard:
- Supabase (Ireland): Ireland has an adequate level of protection under Swiss law; for Supabase's own providers, Standard Contractual Clauses with the Swiss changes.
- Cloudflare (worldwide) and Sentry (Germany; Sentry's company is in the US): the Swiss-US Data Privacy Framework, with Standard Contractual Clauses with the Swiss changes as a fallback.
- Cloudinary (US, until we close it) and Google (US, Sign in with Google): the Swiss-US Data Privacy Framework.
- Anthropic (US; our contract is with Anthropic Ireland, Limited), fal.ai (US) and RevenueCat (US): Standard Contractual Clauses with the Swiss changes.
- FASHN (UK): the United Kingdom has an adequate level of protection under Swiss law; for FASHN's providers (Google Cloud worldwide, fal in the US, BytePlus in Singapore, Malaysia and Indonesia, a database host in the US), FASHN's data processing agreement, which applies the Standard Contractual Clauses with the Swiss changes.
- OpenAI (only as a backup for AI Cleanup; US): OpenAI's data processing agreement, with OpenAI Ireland Ltd.
- Apple (US): Apple's own data protection terms (Standard Contractual Clauses).
- Open-Meteo is a Swiss service.
The United States has an adequate level of protection under Swiss law only for companies certified under the Swiss-US Data Privacy Framework. You can ask us for a copy of the clauses at support@loomweather.com.
If you live in Canada
Who is responsible. The person in charge of the protection of personal information at LOOM Weather is Riccardo Pittiglio, owner and operator. He is also the person accountable for your data under Canada's PIPEDA. You can reach him at support@loomweather.com.
Your data is handled outside Quebec and outside Canada. The services in section 5 handle it in the countries named there. The courts and authorities of those countries may be able to ask for it under their own laws. Before sending your data outside Quebec, we assessed the risks, and we have written agreements with these services.
Features that identify, locate or profile you. Your phone's location is used only if you allow it on your phone. AI styling, which learns your taste, stays off in Canada until you say yes (section 3). The Avatar needs your explicit consent, and you can turn each of these on or off in Profile. The Avatar is not yet offered in Quebec.
Complaints. Write to us first. You can also complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
If you live in Australia or New Zealand
Australia. Your data is sent to the overseas services in section 5. We handle your data to the same standard for everyone, wherever you live, and we stay responsible for it. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
New Zealand. Section 5 tells you which services receive your data and where, and each of them is bound by a written data processing agreement. If you are not happy with our answer, you can complain to the Privacy Commissioner (privacy.org.nz).
People in other countries
You have the same rights wherever you live. LOOM follows the rules of the EU's GDPR for everyone. To use your rights, write to support@loomweather.com. If you are not happy with our answer, you can complain to the data protection authority where you live, for example:
- Singapore. The Personal Data Protection Commission (PDPC, pdpc.gov.sg). Our data protection contact in Singapore is Riccardo Pittiglio, at support@loomweather.com.
- Taiwan. Under Article 8 of Taiwan's Personal Data Protection Act we must tell you certain things when we collect your data. Sections 1 to 7 of this policy tell you.
- Israel. The Privacy Protection Authority.
- Ukraine. The Ombudsman (the Parliament's Commissioner for Human Rights).
- Kenya. The Office of the Data Protection Commissioner (ODPC).
- Chile. From 1 December 2026, the Agency for the Protection of Personal Data (Agencia de Protección de Datos Personales).
11. Automated decisions
LOOM makes no decision about you by automated means that has a legal or similarly significant effect. Some limits are applied automatically, for example the stylist's monthly message limit, and refusing to try on shoes or accessories.
12. Changes
We will tell you in the app before a material change to this policy takes effect.